What is the problem?

As you may know, a new zero-day vulnerability (ADV200006) was raised by the security community. This vulnerability targets Windows systems with Adobe Acrobat installed on it, so as you can imagine, it is a very large impact. The problem occurs if the user opens some infected PDF documents or if the user uses thumbnails in the preview pane to visualize a PDF document.

ADV200006 is using Adobe Type Manager which is managed by the atmfd.dll file. The atmfd.dll file is a kernel module provided by Windows. Using a specially infected document opened or view it in the Windows preview pane, an unauthenticated remote attacker may be able to execute additional code using this Adobe Type Manager Library with kernel privileges on a vulnerable system.

If you are using the sandbox feature on Windows 10, the impact of the attack is limited – but if you are using Windows 10 without sandbox feature activated or a previous version of Windows on your workstations, it will be a huge risk for your organization.

Unfortunately, Microsoft didn’t provided any fix (date is today 2020/03/28) for the moment – for sure it will – in the meantime you must deploy a workaround to change your workstations configuration and be able to wait for the Microsoft patch.

How to mitigate this in a corporate environment?

You can use different mitigation methods, but there are existing some variations depending which Windows versions you are using on your corporate network. So, I choose to describe a mitigation method which will work on your different operating systems from Vista to 10.

Create the first GPO with the user part of the mitigation settings

Open your GPMC console.

Right click on the “Group Policy Objects” folder and select the New option:

Introduction to Spraykatz

As you may know, password hash dump is a very useful method to perform lateral movement or privilege escalation on a network. If you are using Active Directory, this method will be used by a lot of modern malware which include some code pieces from very known security tools like Mimikatz for example.

In this article, we will explorer Spraykatz (v0.9.6) a magnificent tool written by @lydericlefebvre which can help in different situations:

BlueTeam: you want to evaluate how much sensible you are in term of password hash dump, and detect if some malwares or attackers can use this method to find some privilege accounts traces on your workstations

RedTeam: you want to explore the workstations and find a privilege account to use during your escalation

Security Officer, CISO: you want to demonstrate to your internal people how malware can use password hashes in order to educate your people about security issues

Spraykatz is a tool able to retrieve credentials on Windows machines and large Active Directory environments. It simply tries to procdump machines and parse dumps remotely in order to avoid detections by antivirus softwares as much as possible.

Spraykatz uses slighlty modified parts of the following projects:

Mimikatz

Impacket

Pypykatz

Pywerview

Sysinternals

hackndo

How to install Spraykatz

For this article I was using a Kali distro, but you can use ubuntu as well (I tested it on both distros and worked like a charm).

Let’s be root:

sudo su

Get information about your system updates and update the index file for future updates:

root@kali:~# apt update

Reading package lists… Done

Building dependency tree

Reading state information… Done

All packages are up to date.

Ok, here I already have everything updated on my Kali system.

If you don’t have already the last version of python, git and nmap, update it:

How to use Spraykatz

Spraykatz is very simple to use. To use it, you will need to determine:

Which account to use to perform the exploration – here you need to use privilege account (i.e local Admin privilege) on the target system, you may had discovered this type of account from different methods, or even worse, the company is providing regular user accounts which are local Admin on the workstation.

I recently had a discussion with one of my customers, who is French. We were talking about the different security frameworks from the different countries. When i started to explained all the contains which are directly or indirectly provided by the U.S. Government, i wasn’t able to be crytal clear… So i decided to create a simple blueprint which provides a map of the different organizations, the relationships and what is provided to the community. if you want to download it, you get it from: US_cybersecurity_organizations_V1.0